The annual CSO Awards annually recognize security projects that demonstrate outstanding security leadership and business value.
For this year’s program, CSO honors 64 security organizations whose hard work and innovative approaches have had a significant impact on how their enterprises navigate risks in an increasingly challenging cyber environment.
These projects showcase the variety of strategies that CISOs and their teams are employing to bolster enterprise security today. Many leverage the principles of zero trust to reduce risk. Others are using AI and automation to better defend their organization. Still others are using gamification and other change management practices to strengthen security awareness and bolster their first line of defense.
Here, we profile six of these award-winning initiatives that collectively represent the transformative work happening in security today.
Organization: Copart
Project: Making Cybersecurity as Instinctual as Buckling Your Seatbelt
Security leader: Kevin Vuong, CISO
With social engineering still a central initial attack vector today, online car auction company Copart faced a challenge familiar to most CISOs: training workers to automatically incorporate cybersecurity into their daily tasks.
Security process manager Brittany Little says the training and testing strategies that Copart’s security department had been using, such as phishing simulations, weren’t getting the results security leaders wanted to see. And traditional training, which was manual, episodic, and compliance-driven, didn’t match the education needs of a 12,000-member global workforce comprising vastly different role types.
So the security team set about creating a more efficient, impactful security awareness program, Little says, to make cybersecurity behavior as “instinctual as buckling a seatbelt.”
So Copart implemented an automated, adaptive security awareness program that continuously delivers role-based phishing simulations and immediate micro-training tied directly to employee actions. That ensures the training “focuses on the things that matter,” Little says.
The new program is also more intensive, Little says. Previously, security sent out three or four global simulations per quarter. “With a more efficient platform that has more automation and relatable content, we have delivered 202,992 simulations in one year — over 950 of those being unique simulations related to employee’s role, title, behavior analytics in the program,” she notes.
The revamped awareness program also leans into gamification, with live leaderboards, achievements, and recognition. And it replaced manual analysis with automated reporting and executive scorecards.
These improvements have increased the security culture at the company. In the two years before new program was introduced, the simulation reporting rates sat between 17% and 24%; with the new program, the report rate is between 55% and 60%.
“The gamification has been something that has made the training and awareness different,” Little says, noting that it has been key to worker engagement. Workers now boast about their strong performances and talk with one another as well as with security staffers about what they learned in the gamified training sessions.
The scorecards have also been instrumental, giving department leaders metrics on the cybersecurity acuity of each of their workers. “We look at the data, we analyze it, and now we get to go and actually have the conversations that matter,” Little explains. “It has allowed us to actually change behaviors.”
Organization: Hawaii Medical Service Association (HMSA)
Project: Zero Trust Data Governance Initiative
Security leader: Sudhakar Gummadi, CISO
HMSA CISO Sudhakar Gummadi says three forces prompted the nonprofit health insurer’s Zero Trust Data Governance Initiative: an intensifying threat landscape targeting the healthcare sector; increasing regulations and privacy expectations; and HMSA’s expanding digital footprint.
“We recognized that incremental remediation would not meaningfully reduce risk,” Gummadi says. “What was required was a deliberate transformation in how we think about trust, data usage, and accountability across the enterprise.”
HMSA embarked on its Zero Trust Data Governance Initiative in 2024 as part of that transformation.
In addition to implementing and maturing numerous zero-trust principles, HMSA sought to ensure no confidential member information (CMI) left its production zone.
That goal went against traditional healthcare industry practice, where copies of real-life production data existed for use in nonproduction environments to ensure system functionality and fidelity.
That practice, while operationally convenient, significantly increases enterprise exposure to data privacy and cybersecurity risks, Gummadi says, noting that many nonproduction systems don’t have the same security controls as in the production zone.
As such, the initiative’s biggest challenge was the change management component.
“We were asking teams to rethink long‑standing practices around how data is used in nonproduction environments,” Gummadi says. “We addressed this through sustained executive support, transparent communication, and a focus on early wins that demonstrated value — both to the business and to members whose trust we are responsible for protecting.”
In addition to eliminating CMI from all nonproduction environments, HMSA’s initiative sought to protect member data privacy and reduce exposure risk across the entire technology ecosystem; mitigate cybersecurity vulnerabilities associated with nonproduction environments; standardize and modernize data governance practices; and implement a scalable, sustainable, and automated masking framework.
To do that while ensuring operational continuity, HMSA’s security team opted to use high-fidelity, functionally equivalent data for development, testing, and analytics — a significant task, as HMSA had more than 50 terabytes of CMI residing across heterogeneous platforms, diverse data models, and inconsistent data governance processes.
HMSA used an AI-enabled automated data masking suite from Perforce Delphix to identify CMI and apply algorithmically consistent masking rules. That enabled HMSA to fully de-identify CMI in the nonproduction environment.
To ensure long-term sustainability, HMSA’s data governance team established standardized process flows, controls, and a responsibility assignment matrix, enabling automated masked data refreshes and ongoing compliance as systems evolve.
“Trust is foundational to HMSA’s mission. Protecting member information is not simply a compliance requirement; it is a core business imperative,” Gummadi adds. “This initiative strengthened our ability to safeguard that trust at scale, while also improving operational efficiency and enabling more informed decision‑making. It repositioned cybersecurity as a strategic enabler rather than a downstream control.”
Organization: Hensel Phelps Construction
Project: Project SAM
Security leader: Dustin Morris, director of cybersecurity and compliance
Dustin Morris, director of cybersecurity and compliance of Hensel Phelps, faces a scenario common for security leaders: defending against an ever-expanding threat environment with resources that don’t grow as much or as fast.
Starting in 2024, Morris focused on using automation to build capacity, setting out to automate 1,250 hours of manual tasks, effectively replicating a full-time employee’s functions.
“The vision was to really reduce the day-to-day monotonous tasks we have in cybersecurity operations,” says Morris, who took a methodical and enlisted his five-person team.
Together they identified tasks to automate, calculated how much time that automation would save them, and laid the groundwork for automation.
Morris then scheduled an “automation week,” during which the entire team came together to automate those identified tasks. In some cases, they implemented automation capabilities offered within their existing security software, while in other cases they built their own.
Automation work has been ongoing, including a second “automation week” in 2025 — at which point the project was dubbed SAM for “Security Automation Member.”
By early 2026 the security team’s automation efforts eliminated more than 1,250 hours per year of manual effort while improving consistency, reducing human error, and strengthening the company’s security posture. Furthermore, the automation enhanced operational efficiency, optimized license utilization, and improved user experience by reducing downtime and accelerating remediation.
Additionally, the initiative demonstrated how automation can scale security operations to meet business growth without proportional increases in headcount while increasing work-life balance for cyber employees. Project SAM has also enabled security team members to spend more time on high-value proactive security tasks, such as threat hunting.
Morris aims to automate another FTE’s worth of work by the end of 2027.
Organization: K&N Engineering
Project: Code to Cloud Security Transformation
Security leader: Iqbal Rana, CIO
Manufacturing company K&N Engineering manages its own direct-to-consumer ecommerce environment in AWS. CIO Iqbal Rana, who oversees security, has always followed security best practices in the cloud, relying on cloud-native security capabilities and controls implemented by his security team to ensure “we had all the rights things in place.”
But an assessment by his cyber insurance company a couple of years ago alerted him to a security vulnerability in the software deployment tool used by his IT workers.
That alert prompted Rana to immediately address the vulnerability — and to more aggressively look at the risks within his vendor environment and in IT processes, he says.
That led to K&N’s Code to Cloud Security Transformation, which tackles vulnerabilities not only in vendor tools but also in the code his team was deploying.
The initiative involved implementing a code-to-cloud security framework and Wiz technology, which integrated security into every stage of the development lifecycle across K&N’s AWS and Azure environments.
Now his team can proactively identify and remediate vulnerabilities before deployment, ensuring secure, compliant, and efficient cloud operations.
“So we not only fix the deployment risk but also code risk as well,” he says, explaining that the technology prevents code with known vulnerabilities from being inadvertently deployed. “And it doesn’t end there. When the code is deployed [and] you’re live in production, at that point it keeps checking on an ongoing basis. So we have a dashboard that will tell us not only any infrastructure vulnerability but also any problem with the code.”
Rana says the technology enabled a transformative shift-left strategy, as his team can now uncover and remediate hundreds of hidden vulnerabilities. It also gave the team near real-time visibility into risk exposure while strengthening compliance and safeguarding critical revenue streams.
Organization: McDonald’s
Project: Securing the Arches
Security leader: Mike Gordon, CISO
McDonald’s has more than 44,000 locations operating in more than 100 countries, serving 69 million-plus customers daily. Approximately 95% of its restaurants are operated by local franchisees.
The company’s technology stack reflects its size, global reach, and distributed nature. Its cyber risk does, too. For example, its mobile app connects some 250 million consumers to its restaurants.
“Digital transformation created a much more connected ecosystem at McDonald’s than was ever imagined by Ray Kroc,” says company CISO Mike Gordon. “As such, cyber risk was way higher than it ever was.”
An assessment of the company’s security posture performed a few years ago confirmed as much, showing tech leadership there was room for improvement. The assessment determined that the company’s maturity on the NIST Cybersecurity Framework trailed industry peers. It also showed that its cybersecurity capabilities, including foundational controls and visibility into threats and vulnerabilities, varied widely across regions.
As a result, McDonald’s CIO championed a transformation and hired Gordon in early 2024 to execute it.
The Securing the Arches (STA) program modernized and unified cybersecurity across both the company’s corporate and licensed markets. STA established a consistent foundation for identity controls, vulnerability management, data protection, and threat detection across the company’s 100-plus markets. It also established consistent, enterprise-grade protections through shared services that include a global SOC, secure development pipelines, proactive testing, and systemwide endpoint visibility.
The size and structure of this transformation required strong executive skills.
“I’m not a CISO of one company; I’m fundamentally the CISO of about 150 companies, of which I actually only have direct control over one,” Gordon explains, saying transformation success meant building relationships and influencing other leaders as well as deploying the right technology and technical skills within the security team.
STA has strengthened the company’s resilience and reduced risk, thereby providing the security foundation needed to support McDonald’s accelerating digital growth. As the company’s cybersecurity maturity has climbed, Gordon says he’s now enacting Securing the Arches 2.0 with a focus on continually improving the effectiveness of the cybersecurity program. “We’ll continue to evolve,” he adds.
Organization: Midcontinent Independent System Operator (MISO)
Project: STRIKE (Strategic Threat Reduction & Intelligence-Driven Knowledge Engine)
Security leader: Eric Miller, VP and CISO
Like many security departments, MISO’s security team used common tools such as NIST frameworks and other maturity models to score its program and track its maturity improvements.
“But from a threat intelligence and a threat hunting perspective, there wasn’t really a particular meaningful metric to indicate how successful our program was,” says David Webb, director of MISO’s cyber threat action center.
As a result, MISO security leaders and other executives weren’t able to clearly track the center’s effectiveness or whether it was maturing. So in 2024 Webb and threat researcher Nate Apperson started the Strategic Threat Reduction & Intelligence-Driven Knowledge Engine, or STRIKE.
STRIKE transforms cybersecurity risk management by integrating global threat intelligence, MITRE ATT&CK mapping, and NIST frameworks into a unified model. It delivers real-time scoring that quantifies visibility gaps and control effectiveness against real-world adversary tactics. It also prioritizes actions based on threat likelihood and readiness. And it provides a prescriptive path for technical configuration, thereby reducing remediation and analysis cycles to near-instant.
According to Webb, STRIKE ensures security activities align with threat intel and contribute to advancing the overall cyber security strategy. It also provides metrics for measuring the effectiveness of threat hunting — a vital benefit.
“When we do a threat hunt or when we complete one, what’s the output? We wanted more than just a check mark on the top of the page saying that we’ve completed the threat hunt,” Webb explains. “We want to show that we are reducing risk throughout the organization.”
It’s a common challenge, he says, as traditional risk management relies on siloed frameworks and subjective prioritization. This leaves gaps between threat intelligence, control requirements, and technical remediation.
To overcome that challenge, STRIKE operationalizes threat intelligence to identify active adversary behaviors and align them to MITRE ATT&CK techniques, thereby ensuring risk decisions are based on real-world threats. STRIKE also creates links between ATT&CK techniques, NIST CSF functions, and NIST SP 800-53 controls, thus clarifying which controls mitigate which adversary behaviors and highlighting gaps across policy, process, and technology. Additionally, Webb says that by incorporating DISA STIGs, STRIKE provides the technical steps to close control gaps.
Tying it all together is STRIKE’s Detect & Protect Scoring Framework, a quantitative model that measures visibility (detect) and defensive strength (protect) against high-risk techniques with scores weighted by threat likelihood and updated dynamically.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。